Security Guides
How to check if someone accessed your account: sign-in activity, signed-in devices and forwarding settings (Google, Microsoft, Apple, LINE, Instagram, X)
How to check whether someone accessed your account, phone or PC without permission: where to see login activity and signed-in devices on Google, Microsoft, Apple, LINE, Instagram, Facebook and X, mail forwarding rules, iPhone profiles, and what to do first.
Who this is for: anyone who wants to know whether someone has signed in to their account, phone or PC without permission. This guide is based on official help pages from Google, Microsoft, Apple, LINE, Meta (Instagram and Facebook) and X, and on guidance from Japan's IPA (Information-technology Promotion Agency), National Police Agency and Consumer Affairs Agency. The steps assume you are checking your own accounts and devices.
Signs that someone may have accessed your account
If any of these apply, follow the checks below. They are the warning signs that the services' own help pages list.
| Sign | Examples |
|---|---|
| A notice from the service | An email or alert about a sign-in from a new device, a password change you didn't make, or changed account details |
| Codes you didn't request | Two-step verification codes or sign-in prompts arrive when you are not signing in |
| Activity that isn't yours | Emails or messages you didn't send, posts you didn't make, follows or purchases you don't recognize |
| You can't sign in | Your password suddenly stops working and you are asked to reset it |
| Unknown devices | A device you don't recognize appears in the device list or among trusted devices |
The notice email itself can be fake (phishing). Do not open its links; sign in through the official app or a bookmark instead.
Three places to check
1 Inside the account: sign-in activity and signed-in devices
When, on what device and roughly where someone signed in. Sign out unknown devices here
2 Account settings: forwarding, filters, connected apps, recovery details
Settings an intruder adds to keep using the account unnoticed. They survive a password change
3 The device itself: apps, configuration profiles, extensions
If something unknown is installed, a new password can be stolen again
Where to see login activity and signed-in devices, by service
The labels follow each company's official help pages. Screen names can change with app updates and display language.
| Service | Where to see signed-in devices and activity | How to sign out other devices |
|---|---|---|
| Google Account | Google Account > Security & sign-in > Your devices > Manage all devices. For unusual actions, Recent security events > Review security events | Select the device, then Sign out |
| Gmail (Google) | In Gmail on a computer, click Details at the bottom right (last account activity) | Use the Google Account steps above |
| Microsoft account (Outlook.com and others) | The Recent activity page (account.live.com/Activity), covering the past 30 days. Review anything under Unusual activity | Advanced security options > Sign out everywhere > Sign out (can take up to 24 hours; Xbox consoles are excluded) |
| Apple Account | iPhone: Settings > your name > the device list. Web: Devices at account.apple.com | Select the device, then Remove from Account |
| LINE | In LINE on your phone: Home > Settings > Account > Devices | Log out next to each device, or Log out from all services |
| Settings > Password and security (in Accounts Center) > Where you're logged in | Select an account, then Select devices to log out > Log out | |
| Accounts Center > Password and security > Where you're logged in | Select devices to log out, choose sessions (or Select all), then Log out | |
| X | Settings and privacy > Apps and sessions > Sessions, which shows the location and time of each login | Log out next to a session, or Log out all other sessions |
| Amazon | We could not find official help explaining how to view signed-in devices. For a suspicious sign-in notice, Amazon says to check your transaction history | Not confirmed in official help. Amazon advises changing your password and email address and turning on two-step verification |
The location shown can be wrong
The place names in login activity are estimated from your IP address (the number that identifies your connection). Mobile networks, VPNs and travel can show a different city, and Microsoft notes that sign-ins from unusual locations can appear as unusual activity. Don't judge by the city alone; check whether the device type and time match your own use.
For email accounts, always check forwarding and filters
Email accounts are the most valuable target, because other services send password reset links there. If an intruder sets up forwarding or a filter, your mail, including password reset emails, keeps going to them after you change your password. Google's own steps for securing a hacked account include removing unfamiliar Gmail filters and forwarding.
| Where to check forwarding | Where to check filters and rules | |
|---|---|---|
| Gmail (computer) | Settings > See all settings > Forwarding and POP/IMAP (or Forwarding) tab. To stop it, Disable forwarding > Save Changes | See all settings > Filters and Blocked Addresses. Delete any filter you don't recognize |
| Outlook.com | Settings at the top of the page > Mail > Forwarding and IMAP. To stop it, Disable forwarding > Save | Settings > Mail > Rules. Delete any rule you don't recognize with the Delete (trash can) icon |
Pay special attention to filters that forward incoming mail, or that delete or archive it. An intruder may add these to hide security alerts from you. If you are worried because spam appears to come from your own address, see spam from your own email address for how to tell a takeover from a forged sender.
Connected apps and recovery details
Apps connected to your account, such as Sign in with Google or apps authorized on X, stay connected after a password change. Remove any you don't recognize.
- Google: on the linked apps page, select the app, then See details > Remove access > Confirm
- X: in Apps and sessions in your account settings, select Revoke access for the app
Google and Apple also tell you to check whether your recovery phone number, recovery email and other security details were changed without your knowledge. If they were, the intruder can reset the password and take the account back. Apple gives the example of asking your mobile carrier to confirm that SMS forwarding has not been set up on the phone number linked to your Apple Account.
Checking the phone or PC itself
When it feels as if "my phone was hacked", the problem is often an account signed in on the phone. Check the accounts in the table above first, then the device.
| Device | Where to check (labels from official help) | Notes |
|---|---|---|
| iPhone | Settings > General > VPN & Device Management. Select an unknown profile, tap Delete Profile, then restart | If no profiles appear, none are installed. On a work or school phone, ask the administrator first |
| Android (Pixel example) | Google Play Store > profile icon > Play Protect > Settings, and make sure "Scan apps with Play Protect" is on. Settings > Security > Device admin apps to see apps that can administer the phone | Names and locations vary by manufacturer and Android version. Uninstall apps you don't recognize |
| Chrome on a computer | More menu at the top right > Extensions > Manage extensions. Remove extensions you don't recognize | Google's steps for securing a hacked account include removing unknown Chrome extensions |
| The whole computer | Scan with trusted antivirus software | X's help center also recommends a scan if odd activity continues after a password change |
Configuration profiles exist so that companies and schools can manage device settings. As Apple's help explains, deleting a profile also deletes its settings, apps and data, so on a work device ask the administrator rather than deleting it yourself.
If you installed a remote-access app because a caller claiming to be "support" told you to, the device may be under someone else's control. See what to do after a fake virus warning call.
What to do if you find something
If the device looks compromised, use a different, clean device
If the device checks above turned up unknown apps or settings, a new password typed on that device could be stolen again. Use another phone or computer with no problems for the steps below.
Sign out the other devices and sessions
Use the sign-out method in the table above to remove devices you don't recognize. LINE's help center also says to log out unknown devices and then change your password.
Change the password right away
Signing someone out does not stop them signing back in if they know the password. Change it immediately afterward, and change it on every other service where you used the same password. To find out whether it leaked, see how to check if your password was leaked.
Check the recovery email address and phone number
In the account's security settings, make sure the recovery email and phone number are yours, and fix them if not. Do this before setting up two-step verification: if these belong to the intruder, password resets and verification codes go to them, and they can take the account back even after your password change.
Turn on two-step verification or a passkey
This means a known password alone is not enough to sign in. For why authenticator apps and passkeys resist fake sites better than SMS, see which 2FA method is safest.
Remove forwarding, filters and connected apps
Delete any mail forwarding, filters and connected apps you didn't set up yourself. A password change does not remove them.
Check payments and purchases
Review online shopping orders, in-app purchases and your credit card statement. If you see a charge you didn't make, contact the card issuer right away.
If you can no longer sign in
If the password was changed and you are locked out, use each company's official recovery process: Google's account recovery page, Apple's iforgot.apple.com, or "Forgot Password" on X's login screen. Do not follow search ads or emails offering "account recovery services".
This site's view: don't stop at 'I changed my password'
Many people relax once they have changed the password. Read the official help pages side by side, though, and every company asks you to go further: check signed-in devices, forwarding and filters, connected apps and recovery details, separately from the password.
The reason is that an intruder's first move is often to add settings that let them keep using the account unnoticed. If forwarding is still in place, even the reset email for your new password reaches them. Remember the checks in three stages: look at the sign-in activity, remove the settings left behind, then check the device.
Where to get help
| Contact | What they handle |
|---|---|
| IPA Information Security Safety Consultation Desk (Japan) | Technical questions about viruses and unauthorized access. Phone 03-5978-7509 (weekdays 10:00 to 17:00; closed weekends, public holidays and the New Year period) |
| Police consultation line #9110 (Japan) | Connects to the consultation desk of the prefectural police for the area you call from. Not available from rotary-dial lines or some IP phones. On weekends, holidays and at night, an on-duty officer or recorded guidance responds |
| National Police Agency cyber consultation page (Japan) | Online reporting and consultation for cyber incidents, plus a list of prefectural police contacts |
| Consumer Hotline 188 (Japan) | Consumer trouble such as purchases or charges you didn't make. Routes you to a nearby consumer affairs center |
Outside Japan, contact your local police or your country's cybercrime reporting service. Before you call, note the date you noticed the problem and keep screenshots of the login activity and any notice emails; they make it easier to explain.
Sources
The labels and steps in this guide were checked against the following official pages on October 11, 2026.
- Google, "See devices with account access" — support.google.com
- Google, "Secure a hacked or compromised Google Account" — support.google.com
- Google, "Manage connections between your Google Account and third-parties" — support.google.com
- Gmail Help, "Last account activity" — support.google.com
- Gmail Help, "Automatically forward Gmail messages to another account" — support.google.com
- Gmail Help, "Create rules to filter your emails" — support.google.com
- Microsoft, "What is the Recent activity page?" — support.microsoft.com
- Microsoft, "How to sign out of your Microsoft account everywhere" — support.microsoft.com
- Microsoft, "Turn automatic forwarding on or off in Outlook" — support.microsoft.com
- Microsoft, "Manage email messages by using rules in Outlook" — support.microsoft.com
- Apple, "Review devices signed in to your Apple Account" — support.apple.com
- Apple, "If you think your Apple Account has been compromised" — support.apple.com
- Apple, "Review and delete configuration profiles" (Personal Safety User Guide) — support.apple.com
- LINE Help Center, "Checking what devices are logged in to your LINE account and LINE services" — help.line.me
- Instagram Help Center, "View your recent Instagram login activity" — help.instagram.com
- Facebook Help Center, "Log out of Facebook on another device" — facebook.com
- X Help Center, "About third-party apps and log in sessions" — help.x.com
- X Help Center, "Help with my compromised account" — help.x.com
- Amazon Customer Service, "I received a notification about a suspicious sign-in" (Japanese page) — amazon.co.jp
- Google Pixel Help, "Manage your Google Pixel security and privacy settings" — support.google.com
- Google Account Help, "Remove malware or unsafe software" (Android) — support.google.com
- Chrome Web Store Help, "Install and manage extensions" — support.google.com
- IPA, "Information Security Safety Consultation Desk" (Japanese) — ipa.go.jp
- National Police Agency, "Police consultation line #9110" (Japanese) — npa.go.jp
- National Police Agency, "Consultation on cyber incidents" (Japanese) — npa.go.jp
- Consumer Affairs Agency, "Consumer Hotline" (Japanese) — caa.go.jp
Read next
- For your own website or server: How to check if your website or server was hacked
- Takeover or forged sender: Spam from your own email address
- Passwords: How to check if your password was leaked / Are password managers safe?
- Stronger sign-in: Which 2FA method is safest? / Smartphone security basics
- Fake warnings and remote access: What to do about a fake virus warning
- Terms: What is a passkey? / What is phishing? / What is malware?
FAQ
QHow do I check if someone accessed my account?
Open the account's security settings and look at its sign-in activity and list of signed-in devices. On Google, that is Security & sign-in > Your devices; on a Microsoft account, the Recent activity page; on iPhone, Settings > your name and the device list; on LINE, Settings > Account > Devices. For email accounts, also check forwarding settings and filters (rules).
QHow can I tell if my phone has been hacked?
Start with the main account on the phone (Apple Account or Google Account) and look for unknown devices in its device list. Then check the phone itself. On iPhone, look in Settings > General > VPN & Device Management for profiles you don't recognize. On Android, make sure Google Play Protect scanning is on and check Settings > Security > Device admin apps for apps you don't recognize (names vary by manufacturer).
QMy login activity shows a city I've never been to. Was I hacked?
Not necessarily. The location is estimated from your IP address (the number that identifies your connection), and mobile networks or VPNs can show a different city. Microsoft notes that sign-ins from unusual locations, such as when you travel, can appear as unusual activity. Check whether the device type and time match your own use. If they don't, sign that session out and change your password.
QIf I change my password, is the intruder locked out?
Not completely. Signed-in sessions, mail forwarding and filters, and connected apps can remain after a password change. For example, X's help page for compromised accounts notes that the X for iOS and X for Android apps may not be logged out automatically when you change your password, and tells you to revoke the app's access in your settings. On X, also use Log out all other sessions, then remove forwarding and connected apps as well.
QHow far back does login activity go?
It depends on the service. Microsoft's Recent activity page covers the past 30 days. Google's device list shows devices that are signed in now or were signed in during the past few weeks. Take screenshots as soon as you notice something, before older entries disappear; they also help if you ask for help later.
QWhere can I get help if my account was accessed without permission?
In Japan, IPA's Information Security Safety Consultation Desk (03-5978-7509, weekdays 10:00 to 17:00) handles technical questions, the police consultation line #9110 and the National Police Agency's cyber consultation page handle crime reports, and the Consumer Hotline 188 handles disputes over purchases or charges you did not make. Elsewhere, contact your local police or national cybercrime reporting service. If your card was charged, call the card issuer right away.